Rockwell FactoryTalk JWT Auth Bypass Flaw
A JWT signature validation flaw in Rockwell Automation's FactoryTalk Services Platform lets low-privileged users forge tokens and impersonate authorized users.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA and Rockwell Automation disclosed a vulnerability, CVE-2026-10714, in FactoryTalk Services Platform (FTSP) version 6.60, used to manage authentication and directory services across Rockwell's industrial automation products. The flaw arises because FTSP fails to verify that JWT tokens are signed using RSA during Okta Web Authentication, allowing an attacker to set the algorithm field to "none" and craft forged tokens that bypass signature validation entirely.
An authenticated low-privilege user exploiting this weakness could impersonate any authorized user on the FTSP server, gaining unauthorized access to system configuration and the ability to grant permissions to other systems protected by FTSP. This could enable privilege escalation across an industrial control environment. The vulnerability is not exploitable remotely, and CISA states no known public exploitation has been reported. Rockwell has released a patch (RAID 1158263) or the February 2026 Patch Roll-up to remediate the issue, with additional guidance available via Rockwell's advisory SD1786.
The affected platform is deployed worldwide within Critical Manufacturing sector environments. Organizations unable to immediately patch are advised to follow Rockwell's security best practices, isolate control system networks from business networks and the internet, and use secure remote access methods such as VPNs.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-07
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs